This month, security researchers detailed how attackers tampered with the update servers of AOMEI Backupper, a widely used backup tool. According to The Hacker News and Malwarebytes, the attackers changed configuration files on the vendor's servers for only five to ten minutes at a time. Any copy of the software that checked for an update during those windows downloaded and ran a backdoor. No vulnerability in the program itself was needed: the update process simply trusted whatever the server said.
Why It Worked
Reports describe update files that were not cryptographically signed, with the checksum stored inside the same unsigned file that named the download. If an attacker can change one file, they can change both the download and the value used to check it. Short tampering windows also make this kind of attack hard to spot.
Lessons for Teams That Ship Software
If your product includes a desktop app, browser extension, agent or plugin that updates itself, treat the update channel as one of your most sensitive systems.
- Sign every update and every update manifest, and have the app verify signatures with a key that is built into the app, not downloaded alongside the update.
- Keep signing keys off your web servers, ideally in a hardware security module or a managed key service.
- Monitor update servers for unexpected file changes, and alert on them within minutes.
- Publish a clear way for researchers to report problems, and respond quickly when they do.
Lessons for Businesses Using Software
- Keep an inventory of the tools installed on company machines, including small utilities.
- Prefer vendors that sign their software and explain how updates are verified.
- When a vendor discloses an incident, follow their checks even if your machines seem fine. Reports say this malware tried to hide its tracks.
The Takeaway
Automatic updates are essential for security, but only if the update itself can be trusted. Signing and verification turn a dangerous shortcut into a safe one.